Subscribe to KernelEvents::REQUEST instead of KernelEvents::RESPONSE

Created on 10 November 2020, over 3 years ago

Updated 26 April 2023, about 1 year ago

Problem/Motivation

The module currently relies on KernelEvents::RESPONSE to allow/deny access to a page. This event fires very late in the request handling and allows other code to be executed.

Additionally, instead of directly sending the redirect response we should set this to the event in $event->setResponse.

Our setup/usecase is the following:

We have a protected page/node with a private file referenced on it
Access to the private file is being calculated in the hook_access()
Since this hook runs before the event subscriber implemented in the protected pages module, we end up denying access to users even if they should have access.

Steps to reproduce

Adjust Drupal\protected_pages\EventSubscriber\ProtectedPagesSubscriber to rely on KernelEvents::REQUEST so we can return early and use $event->setResponse to set the response.

Proposed resolution

Remaining tasks

User interface changes

API changes

Data model changes

📌 Task

Status

Needs work

Version

1.0

Component

Code

Created by

mbovan

Live updates comments and jobs are added and updated live.

Incomplete comments

Comments & Activities

Not all content is available!

It's likely this issue predates Contrib.social: some issue and comment data are missing.

Comment about 1 year ago →
hasan.A
hasan.A → made their first commit to this issue’s fork.
@hasana-0 opened merge request.
Comment about 1 year ago →
hasan.A
I created a new merge request because the patch was not applicable anymore to any version of the module after 8.14.x.

This merge request attempts to make it work again. The update was needed because of a recent security vulnerability of the module.

contrib.social Blog FAQ Discussions

Production build 0.69.0 2024